Security audit

Obsidian Vaults Workflow Helper

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local Obsidian/Markdown helper, but its alternate instructions and routing metadata are broad enough that it could be invoked for unrelated work and then affect private note files.

Review before installing. Use it only for explicit Obsidian or Markdown-vault maintenance, and require confirmation plus a dry run before bulk edits. Be cautious if your vault contains sensitive personal notes, because the package's routing language is broader than its safest stated purpose.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata and body are materially misaligned: the manifest promises focused help for Obsidian vaults and safe local note maintenance, but the actual description pivots to a broad 'validated demand' and adjacent workflow support narrative. This scope drift can cause the agent to invoke the skill in contexts users did not intend, increasing the chance of overbroad actions, misleading outputs, or unsafe assistance outside the declared trust boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Keywords like 'work', 'plain', 'notes', 'automate', and 'bug fix' are so broad that they are likely to match ordinary conversation and unrelated technical tasks. This creates a prompt-routing vulnerability: the skill can be selected unexpectedly, giving its instructions disproportionate influence over requests that should have been handled by a different, more appropriate skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger sentences are generic enough to match ordinary note-taking or workflow requests, which can cause the skill to activate outside its intended scope. In an agent ecosystem, overbroad routing can lead to unintended file-manipulation guidance being applied in the wrong context, increasing the chance of unsafe or irrelevant actions on local Markdown vaults.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are generic and match ordinary requests such as asking for help or a practical workflow, which can cause the skill to activate outside its intended Obsidian-vault context. Overbroad invocation increases the chance of accidental routing, unexpected file operations, or the skill being selected when a more appropriate and safer skill should handle the request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger section lists generic keywords like "vault," "Markdown notes," and "knowledge base" without defining required combinations, exclusions, or context limits. This can cause unintended invocation for ordinary note-taking or documentation requests that are not specifically about this skill's workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation guidance says to use the skill for broad categories like work-productivity and related practical support, without clearly limiting when it should or should not activate. Ambiguous invocation criteria are dangerous in agent ecosystems because they increase routing errors and allow a loosely scoped skill to influence responses outside its advertised domain.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow authorizes general planning, automation design, analysis, code modification, and decision support well beyond the manifest's vault-maintenance scope. In a skill system, this kind of expansion is dangerous because it silently broadens what the agent may attempt under a trusted label, leading to capability overreach and reduced user ability to predict or constrain behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger terms and examples target generic work/productivity and bug-fix requests instead of clearly Obsidian-vault scenarios. Overbroad triggers make accidental activation much more likely, so the skill may intercept unrelated requests and steer them through instructions that do not match the user's task or expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default prompt is broad and closely matches common user intents around organizing notes and Markdown workflows, which increases the chance of unintended routing to this skill. While the skill appears productivity-focused rather than overtly dangerous, accidental invocation can still cause inappropriate access to or modification of local note content if the platform auto-selects it too aggressively.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Enabling implicit invocation without clear scope constraints allows the skill to be auto-invoked based on loosely related requests, which can expand its effective authority beyond user intent. In a skill that works with local knowledge bases and note maintenance, this raises the risk of unintended file operations, metadata edits, or link changes being suggested or initiated in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger sentences are broad, natural-language phrases that could match ordinary user requests unrelated to this specific skill, causing accidental or excessive activation. In an agent ecosystem, overbroad invocation can route unrelated tasks into a skill with file- and workflow-oriented behaviors, increasing the risk of inappropriate actions, context hijacking, or user confusion.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.